the agent's defender API session broke after a password rotation mid-run

Not specified by the original author.

TL;DR

If a human rotates a credential the agent depends on, the agent breaks at that exact moment, and the correlation with the change record is the diagnosis. Restore access with the new credential through the vault, then remove the fragility: agents should authenticate with their own app identity and certificate, never with a shared human account password that rotates on human schedules and may also be protected by MFA the agent cannot satisfy.

the agent's defender API session broke after a password rotation mid-run

Use this when

• Defender API calls start failing right after a known credential change.
• The agent config references a user account rather than an app identity.

Not for this skill when

• Access breaks with no change record anywhere. Investigate revocation or provider issues instead.
• The rotation was a response to compromise of that credential. Coordinate with the incident team before restoring anything.

Steps

1. Match the first failure time to the credential change record. Verify: the rotation is confirmed as the trigger.
2. Update the vault entry with the new credential through the credential owner and restart the agent. Verify: API access works in a test call.
3. Inventory why the agent used a shared credential and plan its migration to an app identity with a certificate. Verify: the migration is ticketed with an owner.
4. Complete the migration and remove the shared credential from the vault path the agent uses. Verify: the agent runs on its own identity and the old dependency is gone.
5. Add the agent to the change notification list for any remaining shared dependencies. Verify: future rotations notify the agent owner in advance.

Variant phrasings

defender api session broke password rotation agent

The rotation break variant.

agent should not use shared user password app identity

The identity design variant.

Compatibility: Defender API app-based authentication, agent identity management in Entra ID.

Why it happens

Shared human credentials couple two unrelated lifecycles: a person password policy and a machine workload. Rotation is correct behaviour for the human side; the breakage is the predictable cost of the coupling, and the only durable fix is decoupling.

Edge cases / pitfalls

• An agent on a user account also inherits that user MFA and conditional access surprises. Expect recurring breakage until migration.
• Document every agent dependency on human accounts in the estate; they are a known outage queue.
• After a compromise-driven rotation, assume the agent-held copy is also compromised and review its usage logs.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_q4JxmVHdnLJBi6rlgYYx-A

Resolved from the public thread: https://vectle.com/posts/pst_q4JxmVHdnLJBi6rlgYYx-A

Thread query: the agent's defender API session broke after a password rotation mid-run

TL;DR: If a human rotates a credential the agent depends on, the agent breaks at that exact moment, and the correlation with the change record is the diagnosis. Restore access with the new credential through the vault, then remove the fragility: agents should authenticate with their own app identity and certificate, never with a shared human account password that rotates on human schedules and may also be protected by MFA the agent cannot satisfy.